Add fuzzer to test Fuzz URLRequestDataJob

net/base/fuzzed_data_provider.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/fuzzed_data_provider.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/logging.h"
@@ skipping 20 matching lines @@
     uint8_t new_bits = 0;
     if (!remaining_data_.empty()) {
       new_bits = remaining_data_.data()[remaining_data_.length() - 1];
       remaining_data_ = remaining_data_.substr(0, remaining_data_.length() - 1);
     }
     size_t bits_to_add = 8;
     if (num_bits > 8)
       bits_to_add = num_bits;
     new_bits &= new_bits & ((1 << bits_to_add) - 1);
     out = (out << bits_to_add) | new_bits;
-    num_bits -= bits_to_add;
+    num_bits = num_bits > bits_to_add ? num_bits - bits_to_add : 0;

[eroman, 2016/04/27 00:43:01]

Hmm yeah, there does seem to be a bug in the dependent CL! Hadn't noticed that
when reviewing it :)

   }
 
   return out;
 }
 
 bool FuzzedDataProvider::ConsumeBool() {
   return !ConsumeBits(1);
 }
 
 uint32_t FuzzedDataProvider::ConsumeValueInRange(uint32_t min, uint32_t max) {
@@ skipping 11 matching lines @@
   }
 
   // Allow an empty range, unlike ConsumeBits.
   if (needed_bits == 0)
     return min;
 
   return min + ConsumeBits(needed_bits) % (max - min);
 }
 
 }  // namespace net